CVE-2026-54011: Open WebUI Mermaid XSS Vulnerability – Authentication Required

Technical summary

The vulnerability stems from unsafe DOM manipulation in Open WebUI's file preview component. The application processes Mermaid diagram syntax from Markdown files and converts it to SVG using the Mermaid library configured with securityLevel set to 'loose'—a mode that permits script execution within Mermaid diagrams. The resulting SVG is inserted into the page DOM via innerHTML rather than safer methods like textContent or sanitized insertion, allowing embedded JavaScript to execute under the application's origin. Attack vectors include file uploads or crafted Markdown content accessible through the preview interface. The CWE-79 classification confirms this as a classic stored or reflected XSS vulnerability depending on how the Markdown is sourced.

Business impact

Exploitation allows attackers to steal session tokens, modify application data, harvest user information, or escalate privileges within the Open WebUI instance. For self-hosted deployments, the impact is scoped to the affected instance and its authorized users, but could compromise sensitive AI models, training data, or inference outputs stored locally. Organizations using Open WebUI for internal AI tasks face data confidentiality and integrity risks. The requirement for authentication (PR:L in the CVSS vector) and user interaction (UI:R) limits the immediate blast radius but does not eliminate the threat, particularly in environments where users may inadvertently preview untrusted content.

Affected systems

Open WebUI versions prior to 0.9.6 are affected. The vulnerability requires an authenticated user to preview a Markdown file containing malicious Mermaid diagram syntax. Self-hosted instances are at direct risk; the CVSS vector reflects network-accessible deployment scenarios. No evidence indicates that cloud-hosted or managed versions of Open WebUI are exposed, though administrators should verify their specific deployment configuration.

Exploitability

The vulnerability is exploitable by any authenticated user who can control or influence Markdown file content visible in the preview panel. The attack requires user interaction—the victim must view the malicious preview—and the attacker must have authentication to the Open WebUI instance or the ability to inject content into a file accessible to authenticated users. The low complexity (AC:L) and lack of special access requirements (PR:L refers to low-privileged authentication) make this practical to exploit in multi-user environments or scenarios where file upload is enabled. No public exploit code or widespread weaponization has been reported, and the vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update Open WebUI to version 0.9.6 or later. This release addresses the vulnerability by implementing safe DOM insertion methods and likely tightening Mermaid's security configuration. Organizations unable to upgrade immediately should restrict file preview functionality to trusted content, disable Mermaid diagram rendering if not essential, or enforce network-level access controls to limit exposure to authenticated users only.

Patch guidance

Verify your current Open WebUI version (typically found in Settings or About sections of the application). Upgrade to version 0.9.6 or any subsequent release according to your deployment model: for Docker deployments, pull the latest image tag; for source installations, rebuild from the latest branch. Test the upgrade in a non-production environment first to ensure compatibility with your configuration and any custom integrations. Review release notes to confirm security fixes are included.

Detection guidance

Monitor for Markdown files with suspicious Mermaid diagram syntax containing script tags, event handlers, or embedded JavaScript. Log and alert on file preview events, especially those involving recently uploaded or externally sourced content. Inspect access logs for unusual patterns of file preview activity. Web application firewalls (WAFs) can detect payloads within Mermaid diagram blocks if rules are tuned to recognize common XSS patterns. Endpoint detection and response (EDR) tools may identify anomalous JavaScript execution originating from the Open WebUI browser context.

Why prioritize this

While the CVSS score of 8.7 reflects high severity, the requirement for authentication and user interaction reduces immediate critical urgency compared to unauthenticated remote code execution vulnerabilities. However, in multi-user or file-sharing environments, the risk escalates. Prioritize patching if Open WebUI handles sensitive data, if file upload is enabled, or if users may preview untrusted content. Low-risk deployments (single user, no external file ingestion) may defer patching with compensating controls in place.

Risk score, explained

The CVSS 3.1 score of 8.7 (HIGH) reflects high impact to confidentiality and integrity (C:H, I:H), network accessibility (AV:N), and low attack complexity (AC:L). The score is tempered by the requirement for authenticated access (PR:L) and user interaction (UI:R), and by the absence of availability impact (A:N). The Changed Scope (S:C) attribute indicates potential impact beyond the immediate application boundary, relevant for multi-user deployments where one user's session compromise could affect others. Organizations rating this as critical should consider their threat model and the trustworthiness of users with authentication access.

Frequently asked questions